CVE-2026-49322 PUBLISHED

Indian Scout Bobber 2025 Infotainment-to-WCM weak authentication allows recovery of user PIN from observed exchange

Assigner: ASRG
Reserved: 29.05.2026 Published: 29.05.2026 Updated: 29.05.2026

Weak authentication in the Wireless Control Module (WCM) of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network attacker with read access to the in-vehicle network to recover the user-set unlock PIN by passively observing a single PIN authentication exchange. The Infotainment Digital Round display computes its response using a non-cryptographic operation rather than a cryptographic challenge-response, so the PIN is mathematically derivable from one captured exchange, defeating the motorcycle's primary user-authentication control. Specific protocol details have been withheld pending vendor remediation.

Metrics

CVSS Vector: CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS Score: 4.1

Product Status

Vendor Indian Motorcycle (Polaris Inc.)
Product Scout Bobber + Tech
Versions Default: unknown
  • Version 2025 is affected

Solutions

Replace the non-cryptographic response computation with a digital signature (for example ECDSA P-256) or an HMAC over a fresh per-session random nonce, bound to a stable per-vehicle identifier to prevent cross-bike replay.

Credits

  • Scott Sheahan, Rustic Security LLC finder

References

Problem Types

  • CWE-1390 Weak Authentication CWE
  • CWE-327 Use of a Broken or Risky Cryptographic Algorithm CWE
  • CWE-294 Authentication Bypass by Capture-Replay CWE

Impacts

  • Cryptanalysis
  • Authentication Abuse